{"schema":"threatline.record/2","record":{"id":"GHSA-w4c7-34wj-hqm8","aliases":["GHSA-w4c7-34wj-hqm8"],"summary":"Unauthenticated file read leaks master key on Enterprise proxy","details":"### Summary\r\n\r\nAn unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading a file like `/proc/self/environ` exposes `LITELLM_MASTER_KEY` and provider API keys, which gives the attacker full admin access to the proxy. In some configurations, this allows the attacker to then execute arbitrary python code as root.\r\n\r\nOpen source deployments without a license are not affected, because the relevant codepaths only load when an Enterprise license is active. As defense in depth, we also recommend loading the master key from a secret manager instead of the process environment, setting a separate `LITELLM_SALT_KEY`, and limiting the proxy's outbound traffic to known provider endpoints.\r\n\r\n### Mitigations\r\nIf you cannot update immediately, consider implementing the following:\r\n* Block the trigger at the edge using a WAF, ingress filter, or reverse proxy rule: reject or strip POST request bodies that contain any of the JSON keys:\r\n  * `standard_callback_dynamic_params`\r\n  * `gcs_path_service_account`\r\n  * `callbacks`\r\n  * `success_callback`\r\n  * `failure_callback`\r\n* Restrict the proxy’s outbound network access to your configured LLM provider endpoints. The exploit requires the proxy to POST the stolen file contents to an attacker-controlled token endpoint; with egress allowlisted, the exfiltration fails even if the vulnerable code is reached.\r\n\r\nSeparately, we generally recommend keeping the proxy off the public internet where possible (e.g. via VPN, mTLS, an authenticating ingress, or an IP allowlist).\r\n\r\n\r\n### Credit\r\n\r\nOriginally discovered and reported by Dylan Ong at Karmasec - https://karmasec.io/\r\nIndependently discovered and reported by Cyrill Bannwart - Compass Security","categories":["Unclassified"],"product":"litellm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"range":"< 1.103.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"range":"< 1.104.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"range":"< 1.105.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"range":"< 1.106.5"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"version":"1.103.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"version":"1.104.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"version":"1.105.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","source_modified_at":"2026-10-27T21:45:01Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"pip","name":"litellm"},"version":"1.106.5"}],"cvss":10,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T20:33:15Z","modified_at":"2026-10-27T21:45:01Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T21:45:01Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T21:45:01Z","content_hash":"41e83a546ece3c1d7110cdbbc139d033a9c0dff730a73bc33dab4f0f552b3984"}}